Sudo help needed


 
Thread Tools Search this Thread
Operating Systems Solaris Sudo help needed
# 1  
Old 12-07-2016
Sudo help needed

Hello,
I have a wrapper script that I am trying to build/execute, which has two different sub scripts, which run as two separate users.
Purpose is to mask the contents of the script and allow the user to execute utlrp.sql, which requires sys level privs to execute.

User FORD logs in, and executes the wrapper script, wrapper.sh
The wrapper script presents it's content in menu format. Here is what the wrapper.sh
  1. execute one.sql
  2. execute two.sql and three.sql
  3. execute three.sql


A
one.sql
requires no specific credentials
B
two.sql
REQUIRES FORD credentials to execute.
has logid check at beginning and kicks you out if you aren't the FORD user.
three.sql
requires "ORACLE" credentials to log in and execute utilrp.sql -- which requires to log in as sys for execution.
C
three.sql
Same as above, but only runs the utlrp.sql script.


So I edited sudousers (VISUDO) to implement the neccessary privs. (shown in RED)

Code:
## Runas alias
Runas_Alias     DB = oracle
## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
 
 
## Uncomment to allow members of group sudo to execute any command
# %sudo ALL=(ALL) ALL
 
 
## Uncomment to allow any user to run sudo if they know the password
## of the user they are running the command as (root by default).
# Defaults targetpw  # Ask for the password of the target user
# ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
 
 
## Read drop-in files from /usr/local/etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /usr/local/etc/sudoers.d
FORD ALL = (ALL) NOPASSWD: /export/home/oracle/wrapper.sh
FORD ALL = (DB) NOPASSWD: /oracle/12c/bin/sqlplus
(I have also tried the second entry NOT using runas_alias with exact same results)
 
If I execute a sudo -l from the command line, it shows:
$ sudo -l
User ford may run the following commands on falcon:
    (ALL) NOPASSWD: /export/home/oracle/wrapper.sh
    (oracle) NOPASSWD: /oracle/12c/bin/sqlplus

Here is where I'm stuck. From my understanding, for the user to execute this via the sudo functionality, the main wrapper command would be executed as such:
sudo wrapper.sh. It prompts me for the menu as desired. When I choose A, it doesn't see user FORD...and kicks me out.
When I choose B or C, it works fine. It executes the second one fine, and logs in as sys executing the utlrp.sql.

So my question is this: Is there a way to configure the sudo set up so that user FORD executes the wrapper, passes user FORD to menu item A, but only passes it's self as the ORACLE user to menu items B or C for the sake of sqlplus as sys?

Thanks.

Last edited by rbatte1; 12-09-2016 at 10:35 AM.. Reason: Converted to formatted letter number-list
This User Gave Thanks to willyb For This Post:
# 2  
Old 12-07-2016
To keep the forums high quality for all users, please take the time to format your posts correctly.

First of all, use Code Tags when you post any code or data samples so others can easily read your code. You can easily do this by highlighting your code and then clicking on the # in the editing menu. (You can also type code tags [code] and [/code] by hand.)



Second, avoid adding color or different fonts and font size to your posts. Selective use of color to highlight a single word or phrase can be useful at times, but using color, in general, makes the forums harder to read, especially bright colors like red.

Third, be careful when you cut-and-paste, edit any odd characters and make sure all links are working property.

Thank You.

The UNIX and Linux Forums
This User Gave Thanks to Corona688 For This Post:
# 3  
Old 12-07-2016
If you changed your wrapper program to call sudo, rather than vice versa, you could get different menu options calling different sudo users.
These 2 Users Gave Thanks to Corona688 For This Post:
# 4  
Old 12-07-2016
Thank you for the response. Sorry for the color, I didn't realize it would be such a sensitive issue.

As for the recommendation, I don't know that it would fulfill the same security needs, as it would make the script it's self owned by the user, which means that the user could also see it, yes?

Also, by putting the sudo command inside the script, wouldn't that fork off another sub-shell to run the subsequent commands?

Last edited by willyb; 12-07-2016 at 06:41 PM..
This User Gave Thanks to willyb For This Post:
# 5  
Old 12-08-2016
You can't really run code as a different user without putting it in a subshell.

Using sudo inside the script would probably mean splitting off a few more scripts from it so you can put them all in sudoers appropriately, which would mean the parts you wouldn't want seen wouldn't be. If someone sees the code for the menu, who cares, as long as it hasn't got the passwords?
# 6  
Old 12-08-2016
Correct. It doesn't matter, as I'm not using passwords.
For this level of DB login, as SYS, it's not the conventional login/pw sequence.

normal would be
Code:
sqlplus joe/blow@db <enter>

for this, I need to be able to execute AS ORACLE USER
Code:
sqlplus /nolog <enter>
connect /as sysdba <enter>

It will only allow the oracle os user to use this login process.

Oracle is complex in this way that the sys user can log into a layer under the database.
AND unfortunately, this specific oracle script/command REQUIRES to be logged into the database as SYS.


Having said that, I have made progress based upon your suggestions. SmilieSmilie Thank you.
I am able to now execute the wrapper script and option 1 executes as FORD.
I'm not testing option 2, simply because it's a combo of 1 and 3.
So testing option 3, it's a partial success/fail.
I can tell that it is executing as oracle, because oracle user is the only one allowed to see or execute the script.
But the Oracle security doesn't like something, as the second part of the 2 step login is failing.
That part of the script is as follows.

Code:
case
   3)
sqlplus /nolog << EOF
connect /as sysdba
@$ORACLE_HOME/rdbms/admin/utlrp.sql;
        /
EOF
;;
esac

It's telling me invalid user/pass.
Then tries to execute the script, which of course is failing.

So chasing that now.

Also, for giggles, I tried the following at the command line (AS ORACLE)
Code:
sqlplus /nolog <<EOF
connect /as sysdba
show parameter name
EOF

And it worked flawlessly.

Ran the same thing as FORD, and it runs the first line, but then fails on the next.

Last edited by willyb; 12-08-2016 at 03:04 PM..
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Help needed in sudo access

I want to give root access to a user called denielr on server - tsprd01, but do not want to share root password. I have sudoers configured already. He should have all access equal to root. I made this entry in /etc/sudoers, but it is not working denielr tsprd01 =(root) NOPASSWD: ALL I tried to... (2 Replies)
Discussion started by: solaris_1977
2 Replies

2. Shell Programming and Scripting

sudo: sorry, you must have a tty to run sudo

Hi, Have a need to run the below command as a "karuser" from a java class which will is running as "root" user. When we are trying to run the below command from java code getting the below error. Command: sudo -u karuser -s /bin/bash /bank/karunix/bin/build_cycles.sh Error: sudo: sorry,... (8 Replies)
Discussion started by: Satyak
8 Replies

3. Shell Programming and Scripting

sudo: sorry, you must have a tty to run sudo

Hi All, I running a unix command using sudo option inside shell script. Its working well. But in crontab the same command is not working and its throwing "sudo: sorry, you must have a tty to run sudo". I do not have root permission to add or change settings for my userid. I can not even ask... (9 Replies)
Discussion started by: Apple1221
9 Replies

4. Shell Programming and Scripting

ssh foo.com sudo command - Prompts for sudo password as visible text. Help?

I am writing a BASH script to update a webserver and then restart Apache. It looks basically like this: #!/bin/bash rsync /path/on/local/machine/ foo.com:path/on/remote/machine/ ssh foo.com sudo /etc/init.d/apache2 reloadrsync and ssh don't prompt for a password, because I have DSA encryption... (9 Replies)
Discussion started by: fluoborate
9 Replies

5. Shell Programming and Scripting

Any way to know beforehand if SUDO is (going to be) needed?

I'm using virtual file-system in /proc/ to print out 1) current working directory (CWD): ls /proc/$PID/cwd 2) command line*: cat /proc/$PID/cmdline and 3) # of open files: ls /proc/$PID/fdinfo | wc -l All above snippets are part of printfs. Now, some processes complain about SUDO... (1 Reply)
Discussion started by: courteous
1 Replies

6. AIX

sudo log and sudo auditing

Sudo In AIX, how to find out what commands have been run after a user sudo to another user? for example, user sam run 'sudo -u robert ksh' then run some commands, how can I (as root) find what commands have been run? sudo.log only contains sudo event, no activity logging. (3 Replies)
Discussion started by: jalite19
3 Replies

7. Cybersecurity

sudo /bin/sh or sudo su -

we are looking at changing the way we get root on our network. in our current system if an admin needs root access he just gets the root password and uses an su. some of our staff have decided that a sudo to "/bin/sh" will be easer. some of our staff think a sudo to "su -" will be better. I... (0 Replies)
Discussion started by: robsonde
0 Replies

8. UNIX for Dummies Questions & Answers

Unable to use the Sudo command. "0509-130 Symbol resolution failed for sudo because:"

Hi! I'm very new to unix, so please keep that in mind with the level of language used if you choose to help :D Thanks! When attempting to use sudo on and AIX machine with oslevel 5.1.0.0, I get the following error: exec(): 0509-036 Cannot load program sudo because of the following errors:... (1 Reply)
Discussion started by: Chloe123
1 Replies

9. UNIX for Advanced & Expert Users

Sudo help needed

Scenario: I have two servers, A and B. Server A is using autosys to connect to server B via ssh in order to run scripts. The scripts to be run on server B must be run by user "weblogic". So what I did was make the autosys user connect with a ssh key from server A to server B. After that I... (3 Replies)
Discussion started by: blane
3 Replies
Login or Register to Ask a Question